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Jason A Bernstein 
404-264-4040 (Direct Dial) 
jason.bernstein@btIaw.com 

July 12, 2016 

Computer Crime Section 
Virginia Attorney General’s Office 
202 North 9th Street Computer Crime Section 

Richmond, VA 23219 

Re: Reporting Data Security Incident 

Greetings: 

On behalf of Outten & Golden LLP we submit herewith the enclosed data security incident 
notification information, as required under Virginia. 

If you require any additional information, please contact me. 
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Sincerely, 






Jason A. Bernstein 
Barnes & Thornburg LLP 
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Enclosure 

cc: Victoria Spencer Patterson (w/ enclosure, via email) 
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VIRGINIA STATE SECURITY INCIDENT REPORT 


Name and address of Entity that owns or licenses the computerized data that was subject to the breach 

Outten & Golden LLP 

Street Address: 3 Park Avenue. 29 ,h Floor 

City: New York State: NY Zip Code: 10016 


Submitted by: lason A. Bernstein Title: Attorney Dated: lulv 11.2016 

Firm Name (if other than entity): Barnes & Thornburg LLP 

Telephone: 404-264-4040 Email: jason.bernstein@btlaw.com 

Relationship to Entity whose information was compromised: Attorney for Outten & Goldpn I I P 


Type of Organization (please select one): [ ] Governmental Entity; [ ] Other Governmental Entity; 

[ ] Educational; [ (Health Care; [ (Financial Services; [ XJOther Commercial; or ( (Not-for-profit. 


Number of Persons Affected: 

Total: 157 Virginia Residents: 2 


Dates: Breach Occurred: lune 18,2016 Breach Discovered: Lune 18, 2016 Affected Individuals Notified-lune 19 2016 ' 


Description of Breach (please select all that apply): 

( (Loss or theft of device or media (e.g., computer, laptop, external hard drive, thumb drive, CD, tape); 

1 (Internal system breach; [ (Insider wrongdoing; ( (External system breach (e.g., hacking); 

(XJInadvertent disclosure ; (XJOther specify): Employee was a victim of a spoof and sent a file with the W2 information 

the firm's employees to an unauthorized email address 


Information Acquired: Name or other personal identifier in combination with (please select aM that apply): 

[XJSocial Security Number 

[ (Driver’s license number or non-driver identification card number 

( (Financial account number or credit or debit card number, in combination with the security code, access code, 
password, or PIN for the account 


Manner of Notification to Affected Persons - ATTACH A COPY of thf tfupi a tu ou tud \mTirr 
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AFFECTED RESIDENTS: 

I X ] Written ( X ] Electronic ( ] Telephone ( ] Substitute notice 

List dates of any previous (within 12 months) breach notifications: 

-------I 

Identify Theft Protection Service Offered: (X)Yes [ ] No 

Duration: 12 months Provider: AllClearlD 

_Brief Description of Service: Credit monitoring; the firm is also reimbursine employees for the cost of freezing credit 
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TEXT OF COMMUNICATION SENT TO AFFECTED INDIVIDUALS 

Dear O&Gers, 


We value and respect the privacy of your personal information. Therefore, we are writing to 
inform you of an incident involving some of that information, what that means to you, how we 
are actively addressing the situation, and what you might do to protect yourself. 

The Facts As We Currently Know Them 

Late Friday afternoon, June 17, 2016, the firm learned that, as a result of a spoofing attack, 
your W2-related information has been compromised and accessed by unauthorized persons. 
As soon as we became aware of the incident, we started addressing the situation. 

First, we sent an email late Friday afternoon to O&GAll about the episode. Subsequently, we 
retained counsel who are experienced in dealing with such situations. The incident and 
pertinent details are being reported to the appropriate agencies, and we are fully cooperating 
with them. We are sending this information via email today; we will be sending it again via 
mail on Monday. 

We believe that fewer than 200 current and former employees may have been affected. While 
we are unable to determine exactly the extent to which the information has been accessed 
and/oi used, we have received at least one report of an employee’s information being used 
improperly. 

What Type of Information Was Involved? 

The infoi mation that may have been accessed included identifying personal information, such 
as name, address, and social security number. 

Steps You Should Take to Protect Yourself 


Because the firm takes the protection of your personal security very seriously, we are offering 
free credit monitoring services. We are contracting with a credit monitoring service to offer 
you 12 months of services at no cost to you. This product helps detect possible misuse of your 
personal information and provides you with identity protection support focused on immediate 
identification and resolution of identity theft. We will provide a follow up letter shortly that will 
include instructions tor contacting the service provider. Lastly, see the enclosed information for 
additional steps you should take to protect yourself. 

Contact Information 

If you have any questions, please contact: 

Victoria Spencer Patterson, Director of Administration 
Outten & Golden LLP 

3 Park Ave, 29th Floor, New York, NY 10016 
Phone: 646-825-9807 
Fax: 646-509-2082 
Email: vsp@outtengolden.com 



We apologize for any inconvenience this may have caused. Be assured that we have been working, 
and will continue working, diligently to avoid and mitigate any harm to you. 

Sincerely, 

Wayne N. Outten 
Managing Partner 



STEPS YOU CAN TAKE TO FURTHER PROTECT YOURSELF 

We are providing this explanation of steps you can take to protect your information. As a 
precautionary measure, we recommend that you remain vigilant for incidents of fraud and 
identity theft by reviewing your account statements and credit reports closely. You may obtain 
a fiee copy of your credit report from each of the three major credit reporting agencies listed 
below once every 12 months by visiting http://www.annualcreditreport.com or calling toll- 
free 877-322-8228. You can also report any fraudulent activity or any suspected identity theft 
to proper law enforcement authorities, your state attorney general and/or the Federal Trade 
Commission. To file a complaint about identity theft with the FTC or to learn more, go to 
www.ftc.gov/idtheft. call 1-877-ID-THEFT (877-438-4338). 

Fraud Alert 


We suggest you consider placing a fraud alert on your credit report. An initial fraud alert is 
free and will stay on your credit file for at least 90 days. The alert informs creditors of possible 
fraudulent activity within your report and requests that the creditor contact you prior to 
establishing any accounts in your name. If you would like to place a fraud alert on your credit 
report, contact any of the three credit reporting agencies using the contact information below. 
The Federal Trade Commission has a good website with an overview and guidance on this 
issue at https://www.co nsumer.ftc.gov/articles/0497-credit-free7.e-faq< ; You can also contact 
them at: Federal Trade Commission or write to: Federal Trade Commission, 600 Pennsylvania 
Avenue, NW, Washington, DC 20580. Or, call 1-877-ID-THEFT. 

Security Freeze Information 


In some US states, you have the right to place a security freeze on your credit file. This will 
prevent new credit from being opened in your name without the use of a PIN number that is 
issued to you when you initiate the freeze. You can obtain further information regarding 
security freezes from the FTC and from any of the three credit reporting agencies listed below. 


Equifax 

(800)685-1111 
www.equifax.com 
P.0. Box 740241 
Atlanta, GA 30374 


Experian 
(888) 397-3742 
www.experian.com 
P.O.Box 9532 
Allen, TX 75013 


Maryland Residents 


TransUnion 
(800) 916-8800 
www.transunion.com 
P.0. Box 105281 
Atlanta, GA 30348 


Visit the Maryland Office of the Attorney General website at 
www.oag.sta te.md.us/idtheft/index.htm . Call 1-410-528-8662 or write to: Consumer 
Protection Division, Maryland Office of the Attorney General, 200 St. Paul Place, Baltimore MD 
21202 


North Carolina Residents 

Visit the North Carolina Office of the Attorney General at httn://www.ncdoi.gov/Crime.a<;px 
Call 1-919-716-6400 or write to: Attorney General’s Office, 9001 Mail Service Center, Raleigh 
NC 27699-9001 



California Residents 


State law requires us to inform you that law enforcement did not ask us to delay notification to 
you. 

IBS Tax Return Information 

If you suspect that a fraudulent tax return has or may be filed using your social security 
number, you should contact the IRS and file a complaint immediately. For more information, 
see h ttps://www.irs.gov/uac/taxDaver-g u ide-to-identitv-thpfr If you receive a letter from the 
IRS indicating that there has been fraudulent activity, see the information at 
htt ps://idverifY.irs.Rov/IE/e-a uthe ntic at e/welcome.do . The TurboTax website also has good 
information at https://turbo tax.intuit.com/tax-tools/tax-tips/Genpral-Tav-Tins/ldentitv- 
J Mft"What-to-Do-if-SQmeon e-Ha s-A l readv-Filed-Taxes-lJsing -Yonr-.Wial-Wm-ii-w. 
Number/INF23035.html 



